CVE-2019-10403 — Vulnetix

CVE-2019-10403 PUBLISHED CVSS 3.5 LOW

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions.

EPSS 0.27% · 50.9th percentile

Risk Scores

CVSS 2.0

3.5

EPSS Score

0.27%

50.9th percentile

Affected Products

Vendor	Product	Versions
Maven	org.jenkins-ci.main:jenkins-core	0, 2.177
Jenkins project	Jenkins	*
jenkins	jenkins	0, 0

Exploit Intelligence

https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1537%20%281%29 (circl)
[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins (circl)

Timeline

Sep 25, 2019 CVE Published
Oct 9, 2019 CVE Updated
Apr 14, 2021 EPSS Score
Jun 23, 2021 EPSS Score
Aug 24, 2021 EPSS Score
Dec 27, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 28, 2022 EPSS Score
Apr 1, 2022 EPSS Score
May 1, 2022 EPSS Score
Sep 4, 2022 EPSS Score
Nov 6, 2022 EPSS Score

References

https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1537%20%281%29 url
[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins mailing-list
https://nvd.nist.gov/vuln/detail/CVE-2019-10403 advisory
https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1537%20(1) url

Open in Interactive Console →